Malware & Threats
Cisco is warning of a zero-day vulnerability in Cisco ASA and FTD that can be exploited remotely, without authentication, in brute force attacks.
Hi, what are you looking for?
SecurityWeek
Vulnerabilities
Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions.
Vulnerabilities
It abuses CLFS and Windows Defender to trigger arbitrary file creation in the context of the antimalware process.
Malware & Threats
PHP2Shell enabled initial compromise, while CVE-2026-123039 allowed attackers to elevate privileges to root.
Vulnerabilities
Dubbed 4EverAble2Shell, the flaw could allow remote, unauthenticated attackers to execute code with root privileges.
Cyberwarfare
Noteworthy stories that might have slipped under the radar: LastPass vault hacking, Russia targets energy facility in Ukraine, NXP data breach.
Malware & Threats
Apple pushes out an urgent point-update to its flagship iOS and macOS platforms to fix a pair of security defects being exploited in the...
Malware & Threats
Google again catches a North Korean APT actor targeting security researchers with zero-days and rigged software tools.
Vulnerabilities
Cisco has released patches for CVE-2023-20238, a critical authentication bypass vulnerability in the BroadWorks Application Delivery Platform.
Vulnerabilities
Dozens of vulnerabilities have been found in widely used security cameras made by defunct Chinese company Zavio.
Vulnerabilities
Academic researchers design a Chrome extension to steal passwords from input fields and publish it to the Chrome webstore.
Vulnerabilities
Google has released another weekly Chrome update, to address four high-severity vulnerabilities reported by external researchers.
Vulnerabilities
AtlasVPN developers are working on a patch for an IP leak vulnerability after a researcher publicly disclosed the flaw due to being ignored.
ICS/OT
Exploit code and root-cause analysis released by SinSinology document the problem as a case where VMware “forgot to regenerate” SSH keys.
Cybercrime
Weekly cybersecurity news roundup providing a summary of noteworthy stories that might have slipped under the radar.
Vulnerabilities
A vulnerability in the All-in-One WP Migration plugin’s extensions exposes WordPress websites to attacks leading to sensitive information disclosure.
Vulnerabilities
Splunk has released patches for multiple high-severity vulnerabilities impacting Splunk Enterprise and IT Service Intelligence.
Vulnerabilities
Four recent vulnerabilities in the J-Web component of Junos OS have started being chained in malicious attacks after PoC exploit code was published.
Vulnerabilities
Mozilla and Google have released stable updates for the Firefox and Chrome browsers to address several memory corruption vulnerabilities.
Malware & Threats
VWware patches critical flaws that allow hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.
Vulnerabilities
Cisco has released patches for three high-severity vulnerabilities in NX-OS and FXOS software that could lead to denial-of-service (DoS) conditions.
Malware & Threats
More than 3,000 Openfire servers are not patched against a recent vulnerability and are exposed to attacks employing a new exploit.
Vulnerabilities
Google has released the first weekly Chrome security update, which patches five memory safety vulnerabilities, including four rated ‘high severity’.
Vulnerabilities
While initially it was unclear if the Ivanti Sentry vulnerability CVE-2023-38035 has been exploited, the vendor and CISA have now confirmed it.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
RegisterJoin to learn the four levels of architecting security into the agentic SDLC – from securing the code your developers' agents write to running a coordinated system of security agents you've built yourself.
RegisterExpert Insights
Overreliance on AI could erode the creativity, clear communication, and critical thinking security teams need when there’s no playbook.
(Joshua Goldfarb)
Every autonomous AI agent deployed across your enterprise today is a new proxy identity operating inside your perimeter.
(Danelle Au)
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.
(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.
(Sravish Sridhar)